MaskIt - Data Masking Extension for VS Code

Protect sensitive data instantly - mask PII in CSV, JSON, and XML files with customizable rules before sharing or distributing.

Features

• Multiple File Formats: Support for CSV, JSON, and XML files
• Flexible Rules: Define masking rules based on column headers or XML/JSON tags
• Content Rules: Use regex patterns to mask values regardless of field names
• Enable/Disable Rules: Temporarily disable rules without deleting them
• Multiple Masking Types: Replace all, Show ends, Fingerprint, or Scramble
• Wildcard Rules: Use * wildcards to match multiple field names at once
• Protected Fields: Protect specific fields from ever being masked (e.g. IDs, timestamps)
• Protected Content: Protect values matching regex patterns from ALL masking (e.g. dates, booleans, URLs)
• CDATA Support: Masks content inside XML <![CDATA[...]]> sections while preserving the wrapper
• Preview Mode: Preview masked data before applying changes
• Auto-detect Delimiters: Automatically detects CSV delimiters
• Context Menu Support: Right-click access from both editor and file explorer

Installation

From VS Code Marketplace

1. Open VS Code
2. Go to Extensions (Ctrl+Shift+X)
3. Search for "MaskIt"
4. Click Install

Quick Start

1. Open a data file (CSV, JSON, or XML)
2. Run command: MaskIt: Edit Masking Rules
3. Select Add Rule... and choose the rule type you want to add
4. Run command: MaskIt: Mask Data in Current File

Commands

• MaskIt: Mask Data in Current File - Apply masking rules to the active file
• MaskIt: Mask Data and Save As... - Mask and save to a new file
• MaskIt: Edit Masking Rules - Add, edit, or remove masking rules
• MaskIt: Preview Masked Data - Preview without modifying the file

Rule Types

MaskIt supports five rule types, accessible via Add Rule... in the Edit Masking Rules menu:

Masking Types

MaskIt supports four masking types, shown with their display names when adding rules:

Replace all (full)

Replaces every character in the value with the mask character (default *). Use this when you want to completely hide the value.

Show ends (partial)

Shows the first and/or last N characters and masks the middle. Use this when you want to confirm the type of value while hiding the sensitive portion.

You configure how many characters to show at the start and end — for example, start: 2, end: 2:

Fingerprint (hash)

Replaces the value with the first 8 characters of its SHA-256 hash. The output is always a fixed-length alphanumeric string. Use this when you need a consistent, repeatable masked value — the same input always produces the same hash.

Note: Hash output is not reversible but is deterministic — the same value always hashes to the same result.

Scramble (random)

Replaces each character with a random character of the same type while preserving the original case. Use this when you want realistic-looking fake data that maintains the original format.

• Uppercase letters → random uppercase letters
• Lowercase letters → random lowercase letters
• Digits → random digits
• Special characters (spaces, dashes, @, ., etc.) are kept as-is
• Date/time values → a random but valid date/time in the same format

Note: Each masking operation produces a different random output. Use Fingerprint instead if you need consistent results.

Date Format Setting

Ambiguous date formats like XX/XX/XXXX and XX-XX-XXXX can be interpreted as either MM/DD/YYYY (US) or DD/MM/YYYY (AU/UK/EU). Use the dataMasking.dateFormat setting to control the interpretation:

Unambiguous formats (YYYY-MM-DD, ISO 8601, time-only) are unaffected by this setting.

Protected Fields

Prevent specific fields from being masked, even if they match other rules:

• Case-insensitive: id matches ID, Id, iD
• Substring matching: id protects user_id, customer_id, record_id
• Normalized matching: Ignores underscores, spaces, and dashes

Common Use Cases

• Protect identifier fields: id, uuid, key
• Protect timestamps: timestamp, created, updated
• Protect system fields: version, status, type

To add a Protected Field, run MaskIt: Edit Masking Rules → Add Rule... → Protected Field.

Protected Content Rules

Prevent specific values from being masked based on their content, regardless of which field they belong to. If a value matches an exclusion regex, it is never masked — even if a field name rule, wildcard rule, or content rule would otherwise apply.

This is the opposite of Content Rules: Content Rules mask matching values, while Protected Content Rules protect matching values.

How It Works

1. Protected Content Rules are checked before all masking rules
2. If the value matches any enabled exclusion regex, it is skipped entirely
3. Matching is case-insensitive by default; enable case-sensitive matching per rule when adding or editing
4. Works across all file types (CSV, JSON, XML), including XML CDATA content

Preset Protected Content Rules

MaskIt ships with built-in exclusion patterns. They are added as disabled by default.

How to Use

1. Run MaskIt: Edit Masking Rules
2. Select Add Rule... → Protected Content Rule to create a custom pattern, or Add preset Protected Content Rule... to pick from presets
3. Presets are saved as disabled — select Enable / Disable Rule... to activate them

Content Rules

Mask values based on their content using regular expressions, regardless of field names. This is useful for masking data where the field names are inconsistent or unknown.

Example Patterns

How It Works

1. Content Rules are checked after field-based rules
2. If no Field Rule or Wildcard Rule matches, Content Rules are applied
3. Any value matching the regex will be masked according to the rule's settings
4. Matching is case-insensitive by default; enable case-sensitive matching per rule when adding or editing
5. Works across all file types (CSV, JSON, XML), including XML CDATA content

To add a Content Rule, run MaskIt: Edit Masking Rules → Add Rule... → Content Rule.

XML CDATA Support

MaskIt fully supports masking content inside XML <![CDATA[...]]> sections. The CDATA wrapper is preserved in the output — only the content inside is replaced.

<!-- Before -->
<Name><![CDATA[John Smith]]></Name>
<Email><![CDATA[john@example.com]]></Email>

<!-- After (Field Rule on Name, Content Rule for email) -->
<Name><![CDATA[**********]]></Name>
<Email><![CDATA[****************]]></Email>

All rule types work with CDATA content: Field Rules, Wildcard Rules, and Content Rules. Protected Fields and Protected Content Rules also apply — a protected field will not have its CDATA content masked.

Preset Content Rules

MaskIt ships with built-in regex patterns for common PII types. They are added as disabled by default so they have no effect until you activate them.

How to Use

1. Run MaskIt: Edit Masking Rules
2. Select Add Rule... → Add preset Content Rule...
3. Choose one or more presets — they are saved as disabled
4. Select Enable / Disable Rule... to activate them when ready

Enable/Disable Rules

Temporarily disable rules without deleting them. This is useful for testing different masking configurations or keeping rules for future use.

Features

• Toggle Multiple Rules: Select and toggle multiple rules at once
• Visual Indicators: See which rules are enabled (✅) or disabled (🔴)
• All Rule Types: Works with Field Rules, Wildcard Rules, Content Rules, and Protected Content Rules
• Persistent: Disabled rules are saved in your configuration

How to Use

1. Run MaskIt: Edit Masking Rules
2. Select Enable / Disable Rule...
3. Select one or more rules to toggle
4. Rules show current status: ENABLED or DISABLED

When a rule is disabled:

• It won't be applied during masking
• It remains in your configuration for later use
• You can re-enable it anytime

To view the status of all rules, run MaskIt: Edit Masking Rules and select View All Rules.

License

MIT